Fundamentals of Compliance
This domain tests your grasp of what compliance is, why it exists, and how it differs from adjacent functions. Expect questions on definitions, compliance risk, and Pakistan's regulatory architecture.
Core idea
Compliance means adhering to applicable laws, regulations, rules, codes of conduct, and internal policies. Compliance risk is the risk of legal or regulatory sanctions, material financial loss, or reputational damage arising from a failure to comply. It is broader than AML/CFT and broader than paperwork.
Pakistan context
Relevant sources include SECP directions, SBP regulations where applicable, PSX regulations, FMU requirements, the AML Act 2010, the Companies Act 2017, and FATF standards as implemented locally. A firm should map these obligations into a compliance register with owners, deadlines, and evidence.
Worked example
A brokerage employee accepts a large cash deposit from a walk-in client without source-of-funds checks. The compliance officer records it as both a control failure and an AML risk, escalates to the MLRO and board committee, and considers whether an STR to the FMU is required. Reasoning: the issue is not merely a transaction error; it is a failure of preventive controls and reporting judgment.
Traps that cost marks
- Treating compliance as synonymous with internal audit.
- Assuming compliance only means AML/CFT.
- Calling a clear breach a 'commercial decision'.
- Ignoring internal policies because they are not statutes.
Compliance is a control function that protects the licence and the firm's reputation; it is not a profit centre and not a public-relations exercise.